{"id":"CVE-2026-95731","aliases":[],"cve":{"records":[{"id":"CVE-2026-95731","source":"hpe","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-22T14:52:25.204Z","published":"2026-11-03T19:50:49.987Z","modified":"2026-11-09T12:15:01.501Z"}],"publishers":[{"name":"hpe","role":"CNA","organizationId":"eb103674-0d28-4225-80f8-39fb86215de0","modified":"2026-11-03T19:50:49.987Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-09T12:15:01.501Z"}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US","tags":[],"source":"hpe"}],"weaknesses":[{"id":"CWE-798","description":"CWE-798 Use of Hard-coded Credentials","source":"CISA-ADP"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-09T12:14:00.758527Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"total"}]}]},"title":"Unauthenticated Hardcoded Password Vulnerabilities in HPE Networking Fabric Composer Command-Line Interface allow Unauthorized Administrative Access","titleSource":"hpe","descriptionSource":"hpe","description":"Hardcoded password vulnerabilities in the command-line interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to access the affected system using hardcoded credentials. Successful exploitation could allow an attacker to gain unauthorized administrative access to the affected system with elevated privileges.","score":9.8,"severity":"critical","published":"2026-11-03T19:50:49.987Z","modified":"2026-11-09T12:15:01.501Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Hewlett Packard Enterprise (HPE)","name":"Fabric Composer","platforms":[],"versions":[{"version":"7.4.0","status":"affected","lessThanOrEqual":"7.4.0","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.3.4","versionType":"semver"}],"defaultStatus":"affected","cpes":[],"source":"hpe","url":"https://www.cve.org/CVERecord?id=CVE-2026-95731"}],"remediation":[],"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"sources":[{"name":"CVE","id":"CVE-2026-95731","modified":"2026-11-09T12:15:01.501Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-95731"}],"assessments":[{"source":"hpe","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8}],"sourceAffected":[],"observedAt":"2026-11-09T12:20:54.352Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:30:32.029Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-09T12:25:30.564Z","attemptedAt":"2026-11-09T12:25:30.564Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-09T12:25:30.564Z","attemptedAt":"2026-11-09T12:25:30.564Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-09T12:25:30.564Z","attemptedAt":"2026-11-09T12:25:30.564Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-09T12:25:30.564Z","attemptedAt":"2026-11-09T12:25:30.564Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-95731","url":"https://www.first.org/epss/","probability":0.00525,"percentile":0.44799,"date":"2026-11-08","checkedAt":"2026-11-09T12:25:30.564Z"},{"source":"NVD","id":"CVE-2026-95731","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95731","modified":"2026-11-03T20:30:24.880","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-09T12:25:30.564Z"},{"source":"ENISA EUVD","id":"EUVD-2026-116275","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-116275","modified":"Nov 3, 2026, 7:50:49 PM","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-09T12:25:30.564Z"},{"source":"GitHub Advisory Database","id":"GHSA-jx48-vcgf-gh86","url":"https://github.com/advisories/GHSA-jx48-vcgf-gh86","modified":"2026-11-03T21:32:21Z","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-09T12:25:30.564Z"}],"aiSummary":{"text":"HPE Networking Fabric Composer's command-line interface has a hardcoded password vulnerability, allowing unauthenticated remote attackers to gain unauthorized administrative access. Affected versions are 7.0.0 to 7.4.0. Successful exploitation could grant elevated privileges.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-09T12:21:09.275Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-95731"}]}}